man.isc-hmac-fixup.html revision d9184858dd5d7677050a813d444c281c56f697aa
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland - Copyright (C) 2004-2015 Internet Systems Consortium, Inc. ("ISC")
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland - Copyright (C) 2000-2003 Internet Software Consortium.
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland - Permission to use, copy, modify, and/or distribute this software for any
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland - purpose with or without fee is hereby granted, provided that the above
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland - copyright notice and this permission notice appear in all copies.
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland - THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland - REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland - AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland - INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland - LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland - PERFORMANCE OF THIS SOFTWARE.
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland<meta name="generator" content="DocBook XSL Stylesheets V1.71.1">
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland<link rel="start" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland<link rel="up" href="Bv9ARM.ch13.html" title="Manual pages">
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland<link rel="prev" href="man.genrandom.html" title="genrandom">
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland<link rel="next" href="man.nsec3hash.html" title="nsec3hash">
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland<body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF">
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland<table width="100%" summary="Navigation header">
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland<tr><th colspan="3" align="center"><span class="application">isc-hmac-fixup</span></th></tr>
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland<a accesskey="p" href="man.genrandom.html">Prev</a>�</td>
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland<th width="60%" align="center">Manual pages</th>
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland<td width="20%" align="right">�<a accesskey="n" href="man.nsec3hash.html">Next</a>
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland<a name="man.isc-hmac-fixup"></a><div class="titlepage"></div>
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland<p><span class="application">isc-hmac-fixup</span> — fixes HMAC keys generated by older versions of BIND</p>
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland<div class="cmdsynopsis"><p><code class="command">isc-hmac-fixup</code> {<em class="replaceable"><code>algorithm</code></em>} {<em class="replaceable"><code>secret</code></em>}</p></div>
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland<a name="id2624685"></a><h2>DESCRIPTION</h2>
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland Versions of BIND 9 up to and including BIND 9.6 had a bug causing
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland HMAC-SHA* TSIG keys which were longer than the digest length of the
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland hash algorithm (i.e., SHA1 keys longer than 160 bits, SHA256 keys
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland longer than 256 bits, etc) to be used incorrectly, generating a
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland message authentication code that was incompatible with other DNS
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland implementations.
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland This bug has been fixed in BIND 9.7. However, the fix may
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland cause incompatibility between older and newer versions of
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland BIND, when using long keys. <span><strong class="command">isc-hmac-fixup</strong></span>
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland modifies those keys to restore compatibility.
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland To modify a key, run <span><strong class="command">isc-hmac-fixup</strong></span> and
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland specify the key's algorithm and secret on the command line. If the
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland secret is longer than the digest length of the algorithm (64 bytes